mcp-server-semgrep/semgrep-rules/go/lang/security/bad_tmp.yaml

MCP Server for Semgrep Integration - static code analysis with AI

rules:
- id: bad-tmp-file-creation
  message: File creation in shared tmp directory without using ioutil.Tempfile
  languages: [go]
  severity: WARNING
  metadata:
    cwe:
    - 'CWE-377: Insecure Temporary File'
    source-rule-url: https://github.com/securego/gosec
    category: security
    technology:
    - go
    confidence: LOW
    owasp:
    - A01:2021 - Broken Access Control
    references:
    - https://owasp.org/Top10/A01_2021-Broken_Access_Control
    subcategory:
    - audit
    likelihood: LOW
    impact: LOW
  pattern-either:
  - pattern: ioutil.WriteFile("=~//tmp/.*$/", ...)
  - pattern: os.Create("=~//tmp/.*$/", ...)